JP4173401B2 - Router, address identification information management server - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a router and an address identification information management server, and in particular, an access router (Access Router: hereinafter referred to as AR) that relays received packets and a border router (BoardRouter: hereinafter referred to as BR) functioning as a boundary relay device between networks. And it is related with the server which manages the address identification information used in them.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, there is a network address translator (NAT) described in Non-Patent Document 1 as a router having a packet transfer function having a function of rewriting a packet source address. Furthermore, there is Twice NAT described in Non-Patent Document 2 that rewrites not only the source address of a packet but also the destination address as a derivative technique.
[0003]
Twice NAT is not only the source address of a packet in NAT but also the address set in advance in the cache table when there is a collision between the IP address used in the private network and the IP address used in the external network. This technique rewrites the destination address of a packet along the conversion table. However, any of the conventional methods performs address conversion using an address conversion table that is statically stored in advance on the router. For this reason, it is impossible to create a dynamic address translation table or rewrite the address by referring to it, and it is impossible to distinguish addresses before and after translation corresponding to dynamic address translation, so an address translation network can be realized. There wasn't.
[0004]
Japanese Patent Application Laid-Open No. 2004-228561 describes a technique for discriminating between an IPv6 (Internet Protocol version 6) address and an IPv4 (Internet Protocol version 4) address based on an address format.
[0005]
[Patent Document 1]
JP 2003-18185 A (paragraphs 0028-0071)
[Non-Patent Document 1]
Egevang, K. and P. Francis, "The IP Network Address Translator (NAT)", RFC 1631, May 1994.
[Non-Patent Document 2]
Srisuresh, P. and M. Holdrege, "IP Network Address Translator (NAT) Terminology and Considerrations", RFC 2663, August 1999.
[0006]
[Problems to be solved by the invention]
In the study to realize the conventional address translation network, when any device of the address translation network refers to the address of the packet, whether the address is a terminal identification address used in the address translation network, There has been no method for accurately determining whether it is a packet transfer address or an IP communication terminal address in an external IP network. Therefore, an AR having a function of transferring a packet, a BR functioning as a boundary relay device, an increased load on the address management server, and a packet loss due to an inquiry to an unnecessary address management server due to an inquiry about an unnecessary address that is not necessary originally There have been problems such as an increase in packet transfer delay.
[0007]
An object of the present invention is to provide a router and an address identification information management server capable of solving the following two problems that cause these problems.
(First issue)
In a network that uses a terminal identification address and a packet transfer address (hereinafter referred to as an address translation network), the AR and BR hold the AR and BR in order to convert the address of the packet transmitted from the communication source terminal. The address conversion table storing the pair information of the terminal identification address and the packet transfer address is referred to. Here, not only a communication mode in which terminals in the address translation network communicate with other terminals in the address translation network, but also communication with IP communication terminals in an external IP network that does not perform address translation. When taking a communication form (interconnection with an external IP network), a method of converting only the packet destination address in the address translation network and a method of converting both the packet destination and the source address are used in combination. In addition, when interconnecting with an external IP network, a terminal whose packet destination or source address is used in the address translation network when there are a plurality of address translation policies such that the source address is not address translated. Identification address or packet forwarding address Less a either, or there is a first problem that not have to determine whether existing IP communication terminal addresses of the external IP networks.
[0008]
Note that the technique described in Patent Document 1 only determines addresses (IPv4 address and IPv6 address) expressed in different formats, and cannot identify addresses expressed in the same format.
(Second problem)
When the first problem is solved, dynamic address allocation is performed in order to perform address translation in the address translation network. As a method for centrally managing the allocated address information, address translation is performed in the network. A method of installing an address management server for managing information is described in the specification of Japanese Patent Application No. 2002-276196. However, when there are a plurality of address translation networks, and each network assigns a terminal identification address and a packet transfer address according to independent rules, an access router when a packet is transferred across the address translation network There is a second problem that the address type is erroneously determined.
[0009]
[Means for Solving the Problems]
The router according to claim 1 of the present invention is a router that relays received packets,
The address added to the packet is
Expressed in the same format,
A terminal identification address for identifying a communication source terminal and a communication partner terminal that communicate with each other via its own router;
A packet forwarding address for forwarding the packet to another router, and
Addresses that do not require address translation,
Which address is
It includes a determining means for determining based on address identification information for identifying an address type.
[0010]
Even if any of the addresses expressed in the same format is added to the packet, the type can be identified.
In addition, before sending the request for obtaining the address translation information, the router determines whether the address to be translated needs to be address-converted, and performs address translation only for necessary ones, so there is no need for address translation. There is no inquiry about the address. Therefore, network congestion and processing load on the address management server and access router are not increased.
[0011]
The router according to claim 2 of the present invention is the router according to claim 1, wherein the address that does not require address translation is an address assigned in an external network that does not perform address translation and an address that is deemed not necessary to be translated according to a network policy. It is at least one. It is possible to determine that conversion is unnecessary for an address assigned in an external network that does not perform address conversion or an address that is not required for conversion according to a network policy.
[0012]
The router according to claim 3 of the present invention further includes an address identification information table for storing the address identification information according to claim 1 or 2, wherein the address identification information stored in the address identification information table is updated from the outside. It is characterized by that. By preparing a table and updating the stored contents, it is possible to cope with changes in address identification information.
[0013]
According to a fourth aspect of the present invention, the router according to any one of the first to third aspects further includes an address conversion unit that converts an address added to the packet according to a determination result by the determination unit. Features. In this way, the address can be converted only when necessary.
The router according to claim 5 of the present invention is the router according to any one of claims 1 to 4, wherein the address conversion means is based on address conversion information that is a set of the terminal identification address and the packet transfer address. The terminal identification address and the packet transfer address are mutually converted. By doing so, the packet received from the terminal can be transferred to another router.
[0014]
The router according to claim 6 of the present invention is the router according to any one of claims 1 to 5, wherein the address identification information includes network prefix information indicating a network prefix assigned by an Internet administrator,
The determination means includes an address added to the packet,
Whether the terminal identification address and the packet forwarding address added to the packet used in the address translation network using the terminal identification address and the packet forwarding address, or the IP address used in the external IP network The determination is made based on the network prefix information. By determining based on the network prefix information, it is determined whether the destination address or source address of the packet is at least one of a terminal identification address and a packet transfer address, or an IP address used in an external IP network. Can be determined.
[0015]
The router according to claim 7 of the present invention is the router according to claim 6, wherein the address identification information includes address assignment rule information used when assigning the address.
The determination means determines whether an address added to the packet based on the address allocation rule information and used in the address translation network is a terminal identification address or a packet transfer address. Features. By doing so, it is possible to determine the terminal identification address and the packet transfer address based on the address allocation rule information and perform address conversion.
[0016]
The router according to claim 8 of the present invention further includes an address conversion information storage table for storing address conversion information according to any one of claims 5 to 7, and the address conversion stored in the address conversion information storage table Information is updated from the outside. By preparing a table and updating the stored contents, it is possible to cope with changes in address translation information.
[0017]
The router according to claim 9 of the present invention is the router according to any one of claims 1 to 8, wherein the address added to the packet is an IP address in a format compliant with IPv6 (Internet Protocol version 6). And Even when an IP address in a format compliant with IPv6 is added to the packet, the identification can be performed.
[0018]
An address identification information management server according to claim 10 of the present invention provides: Each is provided in an address translation network, which is a network that uses a terminal identification address and a packet transfer address, Own device is provided change address An address identification information management server for managing address identification information for identifying an address type in a network, Address translation where the device is installed Other network change address The address identification information managed by the own device is changed to the other address in at least one of the case of connection to the network and the case where the content of the address identification information managed by the own device is updated. change address In the network Address identification information management server Notification means for notifying to the other change address In the network Address identification information management server Receiving means for receiving the address identification information notified from the device, and updating the address identification information managed by the device according to the received contents of the receiving means. By notifying information for updating the address identification information, change address The contents of the address identification information can be matched with the network.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings. In each drawing referred to in the following description, the same reference numerals are given to the same parts as in the other drawings.
FIG. 1 is a diagram showing a configuration example of a communication system including a router and an address identification information management server according to the present invention. In the figure, the communication system of this example includes terminals 11 and 12, which are mobile terminals, ARs 21, 22, 23, and 24, and BR30. Furthermore, an address management server 40 that manages terminal identification addresses and packet transfer addresses, and an address identification information management server 50 that manages network prefix information and address allocation rule information are provided.
[0020]
The terminals 11 and 12 are mobile terminals such as PDA (Personal Digital Assistant), a mobile phone, and a notebook computer, and can communicate with a partner terminal wirelessly. These terminals 11 and 12 are assumed to have a function of transferring packets using only the terminal identifier if the communication partner is a terminal in the address translation network. In addition, these terminals 11 and 12 have a function of transferring a packet with the destination IP address as the destination when communicating with a terminal in the external IP network.
[0021]
ARs 21 to 24 are routers to which communication terminals are connected via a wireless network. The internal configuration of these ARs 21 to 24 will be described in detail later.
The BR 30 is a router that connects the address translation network and the external IP network. The BR 30 is arranged at the boundary between the address translation network and the external IP network. The internal configuration of this BR 30 will also be described in detail later.
As shown in FIG. 2, the address management server 40 manages the terminal identification address and the packet transfer address, and in response to an inquiry from the AR and BR, the terminal identification address and the packet transfer address Has a notification function 41 for notifying the set.
[0022]
As shown in FIG. 3, the address identification information management server 50 is arranged on the address translation network, the network prefix information assigned to the address translation network by the organization that manages the IP address, and the network The information management function 51 for managing the address assignment rule information applied to assign the terminal identification address and the packet transfer address by the administrator of the network, the network prefix information of the other address translation network, the terminal identification address, A storage function 52 for acquiring and storing packet transfer address allocation rule information, a notification function 53 for notifying such information, and network prefix information and address allocation for all stored address translation networks Has devoted to the delivery function 54 to distribute the rule information to all of the AR in the network, the. As described above, information is notified from the address identification information management server 50 to other devices, and notifications from other devices are received, so that the contents of the address identification information stored in each device can be matched. it can. Hereinafter, this matching of contents is referred to as “synchronization”.
[0023]
In this specification, network prefix information and address allocation rule information may be described together as address identification information.
Returning to FIG. 1, in the network having the above configuration, when a packet 80 sent from the communication source terminal 11 is input to the AR 21, the address added to the packet 80 is converted as necessary. When the packet whose address is converted is input to the AR 22 near the communication partner terminal, the address added to the packet is converted to the original address. This conversion process will be described in detail later.
[0024]
The address is generally added to the header H of the packet. This address is, for example, an address expressed in a format compliant with IPv6. In the present invention, addresses represented in the same format are identified.
In FIG. 4, the terminal 11 in the network NW1 to which the present invention is applied communicates with the terminal 12 in the other network NW2, and communicates with the IP communication terminal 13 in the external IP network NW3. The situation is shown.
[0025]
In this network configuration example, a plurality of address translation networks NW1 and NW2 and an external IP network NW3 that does not perform address translation are connected. Network NW1 and network NW3 are connected by BR30A. The network NW2 and the network NW3 are connected by a BR 30B.
[0026]
The address identification information management server 50A in the network NW1 and the address identification information management server 50B in the network NW2 cooperate to synchronize the contents of the stored address identification information.
Address identification information management servers on each network cooperate with each other, and when a new network is started up, an allocation method and identification method for terminal identification addresses and packet transfer addresses in networks already operating as address translation networks The address identification information is notified and updated when the address identification information is changed. The address identification management server notifies the updated address identification information to all ARs and BRs in its own network when the address identification information of each address translation network held therein is updated.
[0027]
In AR or BR, AR and BR each hold whether the destination address or source address of a packet is a terminal identification address, a packet transfer address, or an IP address used in an external IP network. It is determined using the network prefix information in the address identification information. Next, when there are a plurality of address translation policies in the address translation network (for example, an environment in which only a method for translating a packet destination address and a method for translating both a packet destination address and a source address are mixed) The address rule assignment information is used to identify whether the corresponding address is a terminal identification address or a packet transfer address. Based on which address field of the packet the address determined as the determination result is described (destination address or source address) and from which route of the AR or BR the packet has entered Decide whether to convert or not.
[0028]
Thereby, even when terminals in different networks communicate with each other, address conversion is correctly performed, so that packets can be exchanged.
FIG. 5 is a block diagram showing a configuration for performing address identification and address translation in AR and BR that perform address identification and address translation. The following describes the configuration of the AR, but the configuration of the BR is the same.
[0029]
AR is a router to which communication terminals connect via a wireless network. This AR includes an address identification information table 35 used for determining whether it is a terminal identification address, a packet transfer address, or an IP address of an external IP network, and network prefix information of the address identification information. By using the prefix determination unit 37 for identifying the address of the external IP network, or the terminal identification address / packet transfer address used in the address translation network, and the address identification information allocation rule information Address identification information (terminal identification address or packet) for the terminal identification address / packet transfer address determination unit 38 for identifying whether it is a terminal identification address or a packet transfer address, and a determination target address for conversion Forwarding address ), An address conversion determination unit 39 that determines whether or not address conversion is necessary using the input interface information of the packet in which the address is described, and information indicating whether the address is the source address field or the destination address field; Address identification information table management unit 36 for acquiring or updating the address identification information management table, table lookup unit 32 for referring to the address translation table, and reply to inquiry of address translation information to the table lookup unit 32 In order to acquire a pair of an address conversion unit 31 that performs packet address conversion and a packet transfer address and a terminal identification address required for transmission / reception of packets to / from the network or transmission / reception with a communication terminal For address management server A packet transfer address corresponding to the terminal identification address or the packet transfer address as key information, an address conversion table management unit 34 that inquires about the terminal identification address, and an address conversion that functions as a cache that holds information necessary for the address conversion. The table 33 is included.
[0030]
In the same figure, an address conversion unit 31, a table lookup unit 32, an address conversion table 33, and an address conversion table management unit 34, which are address conversion processing function blocks, are used in an existing router (AR or BR) with an address conversion function. A component that is equipped by software or hardware.
The address conversion unit 31 performs conversion processing on the input address. After conversion by this conversion process, the process proceeds to the next process (S301). The address conversion unit 31 refers to the address conversion table 33 and the address identification information table using the table lookup unit 32 (S302).
[0031]
The address conversion table 33 stores pair information of a terminal identification address and a packet transfer address. Therefore, by referring to this address conversion table 33, either the terminal identification address or the packet transfer address can be converted into the other. For referring to the entry on the address conversion table 33, a table lookup unit 32 provided in an existing router or a NAT function router is used. That is, by referring to the table lookup unit 32, the terminal identification address and the packet transfer address in the address conversion table 33 are retrieved, and a response is returned (S303).
[0032]
The table lookup unit 32 is used when referring to an address conversion table 33 and an address identification information table 35 described later. That is, when the contents of the tables 33 and 35 are searched and a response is obtained, the contents of the table lookup unit 32 are referred to.
The address conversion table management unit 34 has a function of managing the address conversion table 33 provided in the same router. Specifically, the address conversion table management unit 34 inquires of the address management server about the address, and changes the contents of the address conversion table 33 and the table lookup unit 32 according to the content of the reply to the inquiry (S304) (S305). , S306).
[0033]
In addition to the above units, the AR includes an address identification information table 35, an address identification information table management unit 36, a prefix determination unit 37, a terminal identification address / packet transfer address determination unit 38, and an address conversion determination. Part 39 is provided.
(Address identification information table)
The address identification information table 35 stores address identification information used for address type determination processing described later with reference to FIG. One entry of the address identification information includes network prefix information of the address translation network, address allocation rule information, and an option field.
[0034]
The address identification information table 35 is newly added or deleted by the address identification information table management unit 36. That is, the contents of the address identification information table 35 are changed by the address identification information table management unit 36 (S307).
In order to refer to the entry on the address identification information table 35, a table lookup unit 32 provided in an existing router or a NAT function router is used. That is, by referring to the table lookup unit 32, the address identification information in the address identification information table 35 is retrieved, and a response is returned (S308).
[0035]
(Address Identification Information Table Management Department)
The address identification information table management unit 36 has a function of managing an address identification information table 35 provided in the same router. Specifically, the address identification information table management unit 36 updates the contents of the address identification information table 35 when there is an update instruction from the address identification information management server (S309). In this content update, the address identification information management server synchronizes the contents of the address identification information tables in cooperation with the address identification information table management unit provided in the router in each address translation network.
[0036]
Note that the following method can be considered for updating the contents of the address identification information table 35. For example, if a multicast address that can be transferred to the address identification information management table is set and a new address translation network is constructed, or if the address identification information table changes due to a change in the address identification method, etc. For example, a method of forwarding a packet to the destination can be considered.
[0037]
(Prefix determination part)
The prefix determination unit 37 receives a packet address (S310). The prefix determination unit 37 then determines whether the address of the packet destination or source is the terminal identification address or the packet transfer address in the address translation network, or the IP address of the IP communication terminal in the external IP network. judge. In this determination, the network prefix information is referred to in the information of the address identification information table 35 held in the AR or BR (S311).
[0038]
A table lookup unit 32 is used for reading the address identification information table 35 by the prefix determination unit 37. That is, by referring to the table lookup unit 32, the network prefix information in the address identification information table 35 is searched and a response is returned (S308).
[0039]
When referring to the network prefix information, matching with the network prefix of the address is performed. If there is a match as a result of this matching, it is determined that the address is a terminal identification address used in the address translation network or a packet transfer address.
As a result of this determination, when it is determined that the address is an external IP network address, no address conversion is performed, and the address conversion process ends (S312). On the other hand, if it is a terminal identification address or packet transfer address used in the address translation network, the address is passed to the terminal identification address / packet transfer address determination unit 38 (S313).
[0040]
(Terminal identification address / packet transfer address determination unit)
As a result of the determination by the prefix determination unit 37, the terminal identification address / packet transfer address determination unit 38 determines whether the address is a terminal identification address or a packet transfer address. In this determination, address assignment rule information is referred to as information for determination in the address identification information table 35 (S314).
[0041]
The table lookup unit 32 is used for referring to the address identification information by the terminal identification address / packet transfer address determination unit 38. That is, by referring to the table lookup unit 32, the address assignment rule information in the address identification information table 35 is searched, and a response is returned (S308).
[0042]
The address allocation rule information includes a terminal identification that defines a determination bit for determining the type of address and whether the terminal identification address is indicated when the value of the determination bit is “0” or “1”. Address determination bits. In accordance with the determination result using the address allocation rule information, the terminal identification address / packet transfer address determination unit 38 determines whether the address is a terminal identification address or a packet transfer address, The process is passed to the address conversion determination unit 39 (S315, S316).
[0043]
In the prefix determination unit described above, the address assignment rule information is also read at the same time when the address identification information is read, and when the target address is sent to the terminal identification address / packet transfer address unit from the determination result in the prefix determination unit, it is acquired first. The address allocation rule information may be sent simultaneously.
[0044]
(Address conversion judgment part)
The address conversion determination unit 39 determines whether or not to perform address conversion on the packet passed from the terminal identification address / packet transfer address determination unit 38. This determination is made based on the address inflow route information and the address field information (S317).
[0045]
The address inflow route information is information indicating from which route of the AR or BR the packet has flowed. On the other hand, the address field information is information indicating which field (destination address field or source address field) in the packet the address described in the packet is. However, when there are a plurality of address translation policies in the network, the address translation determination unit 39 determines which address translation policy is applied.
[0046]
The address translation determination unit 39 sends a terminal identification address that requires address translation processing and a packet transfer address that requires address translation processing to the address translation unit 31 (S318, S319). On the other hand, for the terminal identification address that does not require address conversion, the subsequent processing ends (S320). The terminal identification address that does not require address conversion is an address that does not require conversion according to a network policy. When the packet transfer address flows in from an incorrect direction, the process proceeds to the discarding process for the packet (S321).
[0047]
The operation of the address conversion determination unit 39 will be described with reference to FIGS.
(Processing by the AR address translation determination unit)
FIG. 6 is a flowchart showing the conversion process by the address conversion determination unit among the functions added to the AR to realize the present invention. In this example, the case of a network using a single address translation policy (method for translating a source address and a destination address) will be described.
[0048]
In the figure, the processing flow related to the destination address is indicated by a broken line, the processing flow related to the transmission source address is indicated by a one-dot chain line, and the processing flow common to both is indicated by a solid line.
In the figure, when the terminal identification address is input, the processing of the address conversion determination unit is started (step S401). First, it is determined whether the input address is a destination address or a source address (step S402).
[0049]
If the input address is the destination address as a result of the determination in step S402, the process proceeds to the address conversion unit (steps S402 → S403 → S404).
If the input address is the source address as a result of the determination in step S402, it is determined from which route the packet has flowed next (step S402 → S406). As a result of the determination in step S406, if it is determined that the packet has flowed in from the inside of the network, the process proceeds to the address conversion unit (step S406 → S407). As a result of the determination in step S406, if it is determined that the packet has flowed in from the communication terminal under the AR, the packet is discarded and the subsequent processing is not performed (step S406 → S408). This is because it is considered that a packet to which a packet transfer address is added flows from an illegal direction.
[0050]
On the other hand, in the figure, when a packet transfer address is input, the processing of the address translation determination unit is started (step S401). First, it is determined whether the input address is a destination address or a source address (step S402).
If the input address is the destination address as a result of the determination in step S402, it is determined from which route the packet has flowed next (step S403). As a result of the determination in step S403, if it is determined that the packet has flowed in from the inside of the network, the process proceeds to the address conversion unit (step S403 → S404). As a result of the determination in step S403, when it is determined that the packet has flowed in from the communication terminal under the AR, the packet is discarded and the subsequent processing is not performed (step S403 → S405). This is because it is considered that a packet to which a packet transfer address is added flows from an illegal direction.
[0051]
As a result of the determination in step S402, if the input address is a transmission source address, the process proceeds to the address conversion unit (steps S402 → S406 → S407).
With the above processing, in order to convert the destination address (excluding the external IP address) of all packets by AR or BR, the terminal identification address is set to the destination address of the packet arriving at AR or BR from the inside of the network. Never be transferred.
(Processing by BR address translation determination unit)
FIG. 7 is a flowchart showing the conversion process by the address conversion determination unit among the functions added to the BR in order to realize the present invention. In this example, a case where there is no plurality of address translation policies (a method for translating a source address and a destination address) will be described.
[0052]
In the figure, the processing flow related to the destination address is indicated by a broken line, the processing flow related to the transmission source address is indicated by a one-dot chain line, and the processing flow common to both is indicated by a solid line.
In the figure, when the terminal identification address is input, the process of the address conversion determination unit is started (step S501). First, it is determined whether the input address is a destination address or a transmission source address (step S502).
[0053]
As a result of the determination in step S502, if the input address is the destination address, the process proceeds to the address conversion unit (steps S502 → S503 → S504).
If the input address is the source address as a result of the determination in step S502, it is determined from which route the packet has flowed next (step S502 → S506). As a result of the determination in step S506, if it is determined that the packet has flowed in from the inside of the network, the process proceeds to the address conversion unit (step S506 → S507). As a result of the determination in step S506, if it is determined that the packet has flowed from the external IP network, the packet is discarded and the subsequent processing is not performed (steps S506 → S508). This is because if the source address is a terminal identification address, it is regarded as an illegal packet.
[0054]
On the other hand, in the figure, when a packet transfer address is input, the processing of the address translation determination unit is started (step S501). First, it is determined whether the input address is a destination address or a transmission source address (step S502).
If the input address is the destination address as a result of the determination in step S502, it is determined from which route the packet has flowed next (step S503). As a result of the determination in step S503, if it is determined that the packet has flowed in from the inside of the network, the process proceeds to the address conversion unit (step S503 → S504). As a result of the determination in step S503, if it is determined that the packet has flowed in from the external IP network, the packet is discarded and the subsequent processing is not performed (steps S503 → S505). This is because it is considered that a packet to which a packet transfer address is added flows from an illegal direction.
[0055]
If the input address is the source address as a result of the determination in step S502, the packet is discarded and the subsequent processing is not performed (steps S502 → S506 → S508). This is because if the source address is a packet transfer address, it is regarded as an illegal packet.
With the above processing, in order to convert the destination address (excluding the external IP address) of all packets by AR or BR, the terminal identification address is set to the destination address of the packet arriving at AR or BR from the inside of the network. Never be transferred.
[0056]
(Storage contents of address identification information table)
FIG. 8 shows an example of the contents of information stored in the address identification information table held by the prefix management server, the access router, and the border router.
In the drawing, network prefix information 61, address allocation rule information 62, and an option field 65 are stored in the address identification information table of this example.
[0057]
The network prefix information 61 is information indicating a network prefix to which the address translation network is assigned by the Internet administrator. This information is an address indicating a network prefix such as “3ffe: 0501: 1823 :: / 48”. The Internet administrator is, for example, IANA (Internet Assigned Numbers Authority).
[0058]
The address allocation rule information 62 is information used to determine whether the address is a terminal identification address or a packet transfer address.
This address allocation rule information is composed of a determination bit 63 and a terminal identification address determination bit value 64. The determination bit 63 is a bit indicating the position on the address of the address determination bit used when determining the address type. The terminal identification address determination bit value 64 is a bit value used to determine whether the bit value is 0 or 1 and is a terminal identification address.
The option field 65 is a field that makes it possible to add other information when address identification is desired.
[0059]
In the figure, when the network prefix information is “A”, the determination bit is “33” and the terminal identification address determination bit value is “0”. When the network prefix information is “B”, the determination bit is “41” and the terminal identification address determination bit value is “1”. When the network prefix information is “C”, the determination bit is “33”, and the terminal identification address determination bit value is “1”. When the network prefix information is “D”, the determination bit is “49”, and the terminal identification address determination bit value is “0”.
(Format of address identification information notification message)
FIG. 9 shows the format of the address identification information notification message. This address identification information notification message is a packet used when the address identification information management server 50 (see FIG. 1) and the address identification information table management unit 36 (see FIG. 5) in the AR or BR exchange information.
[0060]
The address identification information notification message shown in the figure includes an address identification information management server address 71, an AR or BR address 72, a message type 76, and an option field 77. In addition, network prefix information 73, determination bit 74, and terminal identification address determination bit value 75 are included in the address identification information notification message as address identification information.
[0061]
The message type 76 is information indicating the type of the message, such as addition, deletion, and update.
The option field 77 is used when a large number of address identification information must be updated at the same time. By using this option field 77, a plurality of messages can be transmitted as one message.
[0062]
(Packet format)
The format of a packet exchanged between a terminal and a router and between routers will be described with reference to FIG. Between the terminal and the access router, the packet format is as shown in FIG. That is, as shown in FIG. 5A, a packet is composed of a communication partner terminal identification address 81a, a communication source terminal identification address 82a, an option field 83a, and user data 84a.
[0063]
For example, in an address translation network in which both the transmission source address and the destination address of a packet are rewritten between access routers, the format of the packet is as shown in FIG. That is, as shown in FIG. 5B, a packet is constituted by the communication partner packet transfer address 81b, the communication source packet transfer address 82b, the option field 83b, and the user data 84b.
[0064]
(Packet format conversion processing)
FIG. 11 is a diagram illustrating a state in which the packet format is converted in the process of packet transfer. In the figure, when the communication source terminal 11 transfers a packet 80 to the communication partner terminal 12, the communication source terminal identification address 82a is set as the transmission source address, and the communication partner terminal identification address 81a is set as the destination address. . Upon receiving this packet, the access router 21 determines whether or not address translation is necessary, and inquires the translation information to the address management server when address translation is necessary. In this example, it is assumed that both the transmission source address and the destination address require address conversion.
[0065]
The access router 21 that has acquired the address conversion information performs address conversion based on the information. By performing this conversion, both the transmission source address and the destination address become transfer addresses. That is, the packet 80 in which the communication partner packet transfer address 81b and the communication source packet transfer address 82b are set is transferred.
The access router 22 on the communication partner terminal side that has received the packet 80 performs address conversion by the same processing as described above. As a result, the address of the original packet transmitted by the communication source terminal is converted. That is, it is converted into a communication source terminal identification address 82a and a communication partner terminal identification address 81a. The converted packet 80 is transferred to the communication partner terminal 12.
[0066]
(Advantages of performing address translation necessity judgment in the router)
The address management server 40 (see FIG. 1) that manages the address translation information manages a network in which a transfer system and a control system through which user packets do not pass are separated. However, the present invention can also be applied to an end-to-end management type network in which there is no address management server and the address translation information of the communication partner is inquired to the access router connected to the communication partner terminal.
[0067]
Therefore, if the router does not determine whether address translation is necessary, whether or not address translation is necessary for the address management server, the address identification information management server, or the access router connected to the communication partner terminal You will be asked to notify the conversion information. In this way, an inquiry is also made regarding an address that does not originally need to be translated, and an unnecessary address translation information query message is generated. As a result, there is a problem that the network is congested and the processing load of the address management server and access router is increased.
In the present embodiment, the router determines whether the address to be converted needs to be converted before sending an address conversion information acquisition request, and performs address conversion only for necessary ones. No problem.
[0068]
(Advantages of installing an address identification information management server in the network)
When the address identification information management server is installed in the address translation network and the address allocation policy of each address translation network is updated, or the newly established address translation network includes the address identification information management server. When it is connected to the network, the address assignment rule information is individually notified to all routers in the address translation network by exchanging the address assignment rule information with the address identification information management server in the address translation network. Compared to the case, network traffic can be reduced. Further, the network administrator only needs to register the address assignment rule information only in the address identification information management server, and does not need to notify all the routers. For this reason, an address translation network can be introduced more easily than when notification to all routers is required.
[0069]
The modifications of the above embodiment are listed below.
(First modification)
When the address translation policy of packets used in the address translation network is unified, for example, in the address translation network, the destination address and the source address are translated into one address translation policy by the administrator in advance. If they are unified, one entry that can uniquely search the packet transfer address from the terminal identification address and an entry that can uniquely search the terminal identification address from the packet transfer address are written on the address conversion table. These may be referred to. In this way, the address identification information management server does not have to hold the terminal identification address and the address assignment rule information for identifying the packet transfer address. In this case, the terminal identification address / packet transfer address determination unit may not be provided in the AR or BR.
[0070]
(Second modification)
In the above embodiment, it is assumed that the terminal identification address and the packet transfer address have the same format as IPv6, but this is not a limitation. For example, the terminal identification address and the packet transfer address may be in the same format as the IPv4 address system.
[0071]
(Third Modification)
In the above embodiment, the routers provided in the network are AR and BR, but other routers may be provided. For example, the address translation network has an address translation function equivalent to the AR, and the network address translation function is hierarchized and held in the network, thereby making it possible to conceal the detailed movement of the communication terminal from the communication partner. An anchor router (ANR) may be provided.
[0072]
(Fourth modification)
There may be an address translation network (hereinafter referred to as an independent address translation network) that does not have an address identification information management server. However, at this time, the network prefix information and address allocation rule information used in this address translation network cannot be notified to other address translation networks. For this reason, the source address of the packet that arrives at the address translation network from the communication source terminal of the independent address translation network is erroneously determined as an external IP network address in BR and AR.
[0073]
Therefore, in the AR in the address translation network to which the communication partner terminal is connected, the packet transfer address is not converted to the terminal identification address, and the packet is transferred to the communication partner terminal with the source address set as the packet transfer address. The problem that it ends up occurs. This problem can be solved as follows. That is, when a packet is transferred from the independent address translation network to the outside of the own network, it can be solved by always converting the packet source address from the packet transfer address to the terminal identification address.
[0074]
(Fifth modification)
In the AR and BR address conversion processing procedure, the prefix determination unit matches the address prefix with the network prefix information in the address identification information table, and if they match, the address allocation rule information retrieved from the corresponding network prefix information is obtained. It may be passed to a terminal identification address / packet transfer address determination unit. In this case, the terminal identification address / packet transfer address determination unit passed the processing from the prefix determination unit does not need to instruct an address identification information search request to the table lookup unit.
[0075]
(Sixth Modification)
For address allocation rule information in the address identification information table, a terminal identification address determination bit is used as information for identifying whether the address is a terminal identification address or a packet transfer address when referring to the bit value specified by the determination bit. Instead of the value, the packet transfer address determination bit value may be stored in the address identification information table. However, when information is notified and updated between address identification information management servers, if the address determination bit values match, information indicating whether the address means a terminal identification address or a packet transfer address is notified. There is a need.
[0076]
(Seventh Modification)
The processing flow in the address translation function block diagram of AR and BR does not necessarily have to be as shown in FIG. For example, address conversion may be performed as a result of determining whether to perform packet address determination and address conversion using the information used in FIG.
[0077]
(Eighth modification)
In the above embodiment, when a plurality of address translation policies exist in the address translation network, it is not defined what policy each packet or network is address-translated. As an example of this solution, the address translation policy is marked for each packet in the network, or the AR or BR of the network determines from the application, the destination address, etc. and dynamically applies the address translation policy. Methods and the like.
[0078]
(Ninth Modification)
The address conversion policy determination function in the address conversion determination unit 39 (see FIG. 5) may be realized by another functional block separated from the address conversion determination unit. Further, when the address translation policy is unified in advance, the address translation policy determination function may not be provided.
[0079]
(10th modification)
In routers, etc., that configure processing function blocks according to the inflow direction of packets, information on which route the packet used in the address translation determination unit has flowed in is used by performing processing specialized for that function block. There is no need for the processing flow. Similarly, in a router or the like that constitutes a processing function block for each address field of a packet, there is no need for a processing flow that uses information such as which address field of a packet has been performed by the address translation determination unit.
[0080]
(Eleventh modification)
In the above embodiment, only the function for realizing the address translation function has been described. However, when a packet transferred from a communication terminal in the address translation network is transmitted with a terminal identification address, an illegal packet is transmitted. If necessary, a packet filtering function may be added.
[0081]
(Twelfth modification)
When an address identification information update message for exchanging address identification information is transmitted from the address identification information management server to an AR or BR in the address translation network, all ARs and BRs are registered in advance as multicast addresses. Thus, the number of address identification information update messages can be reduced by transmitting to the multicast address.
[0082]
(13th modification)
In the above embodiment, the address identification information management server is introduced, and the address identification information that defines information such as address allocation in each network is notified / updated via the address identification information management server. Instead of introducing an information management server, the AR and BR in the address translation network may exchange information in an autonomous and distributed manner.
[0083]
(Summary)
In the present invention, identification of addresses expressed in the same format is performed in the router. For this reason, problems such as an increase in addition to the address management server, a packet loss due to an unnecessary inquiry to the management server, and an increase in packet transfer delay can be solved. In addition, address identification information is managed in units of networks, and when the address identification information is updated, the information is exchanged with other address identification information management servers, and the information is notified to routers in the network, Costs for introducing each network address translation network (setting of address identification information to the router, etc.) can be reduced, and the number of notification messages to the router can be reduced when viewed from the whole network.
[0084]
【The invention's effect】
As described above, according to the present invention, in a router such as AR or BR, an existing IP address, a terminal identification address, and a packet transfer address are accurately determined, so that a terminal in a network including the router can be identified. There is an effect of enabling communication with an IP communication terminal in an external IP network (interconnection with an external IP network).
In addition, when performing address conversion of packets as necessary, unnecessary queries to the address management server are reduced, and the administrator of each network can freely assign rules for assigning terminal identification addresses and packet forwarding addresses. There is an effect that can be determined.
[0085]
Furthermore, there is an effect that it is possible to allow a plurality of address translation policies to exist in the address translation network. For example, a packet in the address translation network can perform an address translation policy that performs address translation for the destination address and source address of the packet, but does not translate the source address when interconnected with an external IP network.
In addition, since the address identification information management server notifies instead of notifying each router individually, there is an effect that the number of notifications is reduced for the entire network.
[Brief description of the drawings]
FIG. 1 is a schematic diagram showing the configuration of a network configured using a router according to the present invention.
FIG. 2 is a block diagram showing main functions of the address management server in FIG. 1;
FIG. 3 is a block diagram showing main functions of the address identification information management server in FIG. 1;
FIG. 4 is a diagram illustrating a state in which a plurality of address translation networks configured using a router according to the present invention and an external IP network are connected and communication is performed therebetween.
FIG. 5 is a block diagram showing a configuration for performing address identification and address conversion in the router of the present invention.
FIG. 6 is a flowchart showing processing of an address translation determination unit when the present invention is applied to an access router.
FIG. 7 is a flowchart showing processing of an address translation determination unit when the present invention is applied to a border router.
FIG. 8 is a diagram illustrating the contents of an address identification information table held by a prefix management server, an access router, and a border router.
FIG. 9 is a diagram showing a format of an address identification information notification message transmitted for notification from the address identification information management server to AR and BR.
10A is a diagram showing a format of a packet exchanged between a terminal and an access router, and FIG. 10B is a diagram showing a format of a packet exchanged between access routers.
FIG. 11 is a diagram illustrating a state in which a packet format is converted in a process of packet transfer.
[Explanation of symbols]
11, 12, 13 terminal
21, 22 Access router
31 Address converter
32 Table lookup section
33 Address conversion table
34 Address conversion table management unit
35 Address identification information table
36 Address Identification Information Table Management Unit
37 Prefix determination part
38 Address determination unit for packet transfer
39 Address conversion judgment part
40 Address management server
50 Address identification information management server
50A address identification information management server
50B address identification information management server
61 Network prefix information
62 Rule information
63 Judgment bit
64 Address identification bit value for terminal identification
65 Optional fields
71, 72 addresses
73 Network prefix information
74 judgment bit
75 Address identification bit value for terminal identification
76 Message type
77 Option Field
80 packets
81a Communication partner terminal identification address
81b Communication partner packet transfer address
82a Source terminal identification address
82b Source packet transfer address
83a, 83b Option field
84a, 84b User data
NW1-NW3 network

Claims (10)

A router that relays received packets,
The address added to the packet is
Expressed in the same format,
A terminal identification address for identifying a communication source terminal and a communication partner terminal that communicate with each other via its own router;
A packet forwarding address for forwarding the packet to another router, and an address that does not require address translation;
Which address is
A router comprising determination means for determining based on address identification information for identifying an address type. 2. The router according to claim 1, wherein the address that does not require address translation is at least one of an address assigned in an external network that does not perform address translation and an address that does not require translation according to a network policy. . The router according to claim 1 or 2, further comprising an address identification information table for storing the address identification information, wherein the address identification information stored in the address identification information table is updated from the outside. The router according to any one of claims 1 to 3, further comprising address conversion means for converting an address added to the packet according to a determination result by the determination means. The address conversion unit converts the terminal identification address and the packet transfer address to each other based on address conversion information that is a set of the terminal identification address and the packet transfer address. The router according to any one of claims 1 to 4, characterized in that: The address identification information includes network prefix information indicating a network prefix assigned by an Internet administrator,
The determination means includes an address added to the packet,
Whether the terminal identification address and the packet forwarding address added to the packet used in the address translation network using the terminal identification address and the packet forwarding address, or the IP address used in the external IP network 6. The router according to claim 1, wherein the determination is made based on the network prefix information. The address identification information includes address assignment rule information used when assigning the address,
The determination means is attached to the packet based on the address allocation rule information, and an address used in the address translation network is:
7. The router according to claim 6, wherein it is determined whether the address is a terminal identification address or a packet transfer address. The address conversion information storage table for storing address conversion information is further included, and the address conversion information stored in the address conversion information storage table is updated from the outside. Router as described in. The router according to any one of claims 1 to 8, wherein the address added to the packet is an IP address in a format based on IPv6 (Internet Protocol version 6). Address identification for managing address identification information for identifying the address type in the address translation network in which the device itself is provided , each provided in an address translation network that is a network that uses a terminal identification address and a packet transfer address An information management server, at least one of when the address translation network provided with the device itself is connected to another address translation network and when the contents of the address identification information managed by the device are updated case, notifies the address identification device itself manages a notification unit for notifying the address identification information management server in the other address conversion network, the address identification information management server in the other address conversion network Receiving the received address identification information And a stage, the address identification information management server and updates accordingly the address identification device itself manages the received content of said receiving means.

Images